Paper/Archive/CVE-2024-6047

CVE-2024-6047

GeoVision GV_DSP_LPR_V2 — GeoVision EOL device - OS Command Injection

KEV · due 28 May EPSS 10%public exploit SSVC act CVSS 9.8

CVSS 9.8 (CNA)9.8 / 10 × 3029.4 In CISA KEV+3030.0 EPSS percentile 95.6.956 × 2019.1 Exploit: SSVC active+1010.0 SSVC exploitation: active+1010.0

Description · from the CVE record

Certain EOL GeoVision devices fail to properly filter user input for the specific functionality. Unauthenticated remote attackers can exploit this vulnerability to inject and execute arbitrary system commands on the device.

Affected

ProductAffectedFixed inSource

GV_DSP_LPR_V2all–CNA

GV_IPCAMD_GV_BX1500all–CNA

GV_IPCAMD_GV_CB220all–CNA

GV_IPCAMD_GV_EBL1100all–CNA

GV_IPCAMD_GV_EFD1100all–CNA

GV_IPCAMD_GV_FD2410all–CNA

GV_IPCAMD_GV_FD3400all–CNA

GV_IPCAMD_GV_FE3401all–CNA

GV_IPCAMD_GV_FE420all–CNA

GV-VS14_VS14all–CNA

GV_VS03all–CNA

GV_VS2410all–CNA

Scores by source

twcert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

writeuptwcert.org.tw/tw/cp-132-7883-f5635-1.html writeuptwcert.org.tw/en/cp-139-7884-c5a8b-2.html refakamai.com/blog/security-research/active-exploitation-mirai-geovision-iot-botnet refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-6047 kevcisa.gov/known-exploited-vulnerabilities-catalog